According to ChainCatcher, as reported by Cointelegraph, the U.S. government filed two legal lawsuits on October 4, beginning the process of seizing over $2.67 million in digital assets stolen by the North Korean hacker group Lazarus Group.According to legal documents, the U.S. government is seeking to recover approximately $1.7 million in USDT that the group stole during the Deribit hack in 2022, where $28 million was taken from the options exchange. After successfully hacking Deribit's hot wallet, the hackers mixed the funds through the Tornado Cash mixer and multiple Ethereum addresses.U.S. law enforcement officials are also seeking to recover approximately $970,000 in Avalanche-bridged Bitcoin (BTC.b), which was stolen by the Lazarus Group during a hack of the Stake.com gambling platform in 2023. This malicious attack resulted in losses of over $41 million for Stake.

ChainCatcher news, according to Cointelegraph, cybersecurity experts warn that the notorious North Korean hacking group "Lazarus Group" may target the U.S. Bitcoin ETF as a new attack vector. Michael Pearl, Vice President of GTM Strategy at Cyvers, stated that hackers might turn their attention to the U.S. Bitcoin ETF due to the potential for massive returns.According to Dune data, U.S. ETFs currently hold Bitcoin worth $52.1 billion, making it an enticing target for hackers. Pearl warned that not only ETF providers could become targets, but all companies associated with them would also face risks, making ETF vulnerabilities a pressing issue that needs to be addressed quickly, or else a "super hacker" incident could occur.

ChainCatcher news, according to The Block, the Federal Bureau of Investigation (FBI) has indicated that North Korean cybercriminals are "actively targeting" employees in the Web3 industry to steal cryptocurrency funds.In a press release issued on Tuesday, the FBI noted that North Korean criminals have deployed sophisticated social engineering strategies to deceive individuals at cryptocurrency and decentralized finance (DeFi) companies, thereby "compromising networks associated with cryptocurrency assets." Such schemes pose a "persistent threat" to entities holding significant amounts of cryptocurrency or related products.The FBI further stated: "In recent months, North Korean malicious cyber actors have researched various targets related to cryptocurrency exchange-traded funds (ETFs). This research includes preparatory work before actions, indicating that North Korean attackers may conduct malicious cyber activities targeting companies associated with cryptocurrency ETFs or other cryptocurrency-related financial products."In addition to researching potential targets, North Korean cybercriminals also impersonate well-known members within companies or fabricate false scenarios (tailored to the victim's background, skills, or business interests) to gain and exploit their trust.

ChainCatcher message, Microsoft cybersecurity researchers have discovered a zero-day vulnerability in the Chromium engine, which powers browsers like Chrome. This vulnerability has been exploited by a North Korean hacker group known as Citrine Sleet, specifically targeting cryptocurrency users. Citrine Sleet has used a rootkit malware called FudModule to create fake cryptocurrency trading platform websites, luring users into downloading malware or weaponized cryptocurrency wallets, thereby gaining remote code execution access to steal the victims' crypto assets. This vulnerability was patched on August 21, and users are urged to update their browsers as soon as possible to ensure safety. This is the third exploited Chromium zero-day vulnerability this year.

ChainCatcher news, according to DL News, the U.S. State Department is offering a reward of $10 million for information leading to the location of North Korean hacker Rim Jong Hyok. He has been involved in plotting hacking attacks and extorting hospitals, laundering ransom proceeds, and using them to fund computer intrusions against global defense, technology, and government entities. Court documents show that Rim Jong Hyok and his associates work for the North Korean Reconnaissance General Bureau, known in the private sector as "Andariel," "Onyx Sleet," and "APT45."

ChainCatcher news, blockchain analysis provider Elliptic stated that a hacker group linked to North Korea may be behind the "$235 million WAZIRX hack incident."

ChainCatcher news, according to DLNews, a United Nations report states that North Korean hackers are infiltrating the cryptocurrency industry by impersonating job seekers. These fraudulent recruitment schemes have reportedly earned North Korea up to $600 million annually, with around 4,000 North Koreans attempting to enter the Western tech industry, including the cryptocurrency sector, by concealing their identities. Over the past seven years, North Korean hackers have stolen $3 billion worth of cryptocurrency assets through 58 cyber theft cases. Experts warn that this trend may just be beginning, posing new security challenges for the cryptocurrency industry.MetaMask Chief Security Researcher Taylor Monahan pointed out that North Korea generates revenue through the illegal sale of resources, IT jobs, manual labor, and hacking activities. With the launch of Bitcoin ETFs, Wall Street has begun to view cryptocurrencies as an asset class, leading to a surge in recruitment demand within the cryptocurrency industry. However, the influx of fraudulent job seekers has made hiring increasingly difficult.

ChainCatcher news, Arkham posted on X platform stating that in April this year, ZachXBT published the investigation results on the activities of the North Korean hacker group Lazarus Group. He supplemented the data of this investigation with the entity addresses marked on the Arkham platform, and an additional 7 addresses hold 891.13 bitcoins, worth 63.23 million dollars.Previous news, ZachXBT claimed that Lazarus Group has laundered 200 million dollars of stolen cryptocurrency into fiat currency over four years.

ChainCatcher news, a United Nations report shows that North Korean hackers laundered $150 million worth of stolen crypto assets through Tornado Cash in March 2024. In March 2023, North Korean hackers illegally extracted $147.5 million worth of cryptocurrency from HTX. A year later, these funds were transferred to North Korea via Tornado Cash.According to Reuters, the United Nations is currently investigating 97 incidents of North Korean cyberattacks, which have consumed approximately $3.6 billion worth of cryptocurrency between 2017 and 2024.

ChainCatcher message, Railgun responded to the accusation of "North Korean hackers using the system" by stating that the hacker group "has been banned from using the Railgun system" and described this as a false and erroneous accusation.

ChainCatcher news, according to Nikkei, the United Nations Security Council has released the final report of the expert group reviewing the implementation of sanctions against North Korea. The report indicates that approximately 50% of North Korea's foreign exchange income comes from cyberattacks. North Korea is under investigation for allegedly participating in cyberattacks against companies related to crypto assets (virtual currencies), which have caused losses of about $3 billion.It is reported that the expert group investigated the implementation of sanctions against North Korea from July 2023 to January 2024, revealing methods used to evade sanctions. The report is not legally binding, but the Security Council or member states may impose new sanctions on organizations or individuals that violate the rules based on the report.

ChainCatcher news, according to Arkham, the North Korean hacker Lazarus Group has just completed the largest transaction in over a month, withdrawing 1 million dollars worth of Bitcoin from a seemingly mixing service website, and then sending 150,000 dollars of it to an inactive address they had sent to before.

ChainCatcher news, according to a report by TRM Labs, shows that attacks related to North Korean hackers stole at least $600 million in cryptocurrency in 2023.It is reported that nearly one-third of the stolen funds in cryptocurrency attacks last year were caused by North Korean hackers.

ChainCatcher news, the on-chain analysis agency X-explore posted on social media stating that it believes the reason for the attack on Poloniex is the leakage of private keys, and the attackers are the Lazarus Group.It is reported that this attack is similar to the attack on Stake.com on September 4, 2023, where hackers stored different tokens in different addresses, with each address handling only one type of token.

ChainCatcher news, FixedFloat stated on social media that after three days of coordination efforts by the team, they successfully thwarted a money laundering attempt related to the North Korean hacker group Lazarus, with a total of approximately 2 million dollars in frozen funds.

According to ChainCatcher news and reported by Yonhap News Agency, over the past year, the North Korean hacker group Lazarus Group has laundered more than $900 million (approximately 1.2 trillion won) in cryptocurrency through cross-chain bridges, accounting for about one-seventh of the total amount laundered through cross-chain bridges in the past year ($7 billion).